2015-04-22 07:23:47 +08:00
|
|
|
/*
|
2015-05-16 07:26:10 +08:00
|
|
|
* key management facility for FS encryption support.
|
2015-04-22 07:23:47 +08:00
|
|
|
*
|
|
|
|
* Copyright (C) 2015, Google, Inc.
|
|
|
|
*
|
2015-05-16 07:26:10 +08:00
|
|
|
* This contains encryption key functions.
|
2015-04-22 07:23:47 +08:00
|
|
|
*
|
|
|
|
* Written by Michael Halcrow, Ildar Muslukhov, and Uday Savagaonkar, 2015.
|
|
|
|
*/
|
2015-05-16 07:26:10 +08:00
|
|
|
|
2015-04-22 07:23:47 +08:00
|
|
|
#include <keys/user-type.h>
|
|
|
|
#include <linux/scatterlist.h>
|
2017-06-19 15:27:58 +08:00
|
|
|
#include <linux/ratelimit.h>
|
|
|
|
#include <crypto/aes.h>
|
|
|
|
#include <crypto/sha.h>
|
2016-11-27 09:32:46 +08:00
|
|
|
#include "fscrypt_private.h"
|
2015-04-22 07:23:47 +08:00
|
|
|
|
2017-06-19 15:27:58 +08:00
|
|
|
static struct crypto_shash *essiv_hash_tfm;
|
|
|
|
|
2015-04-22 07:23:47 +08:00
|
|
|
static void derive_crypt_complete(struct crypto_async_request *req, int rc)
|
|
|
|
{
|
2015-05-16 07:26:10 +08:00
|
|
|
struct fscrypt_completion_result *ecr = req->data;
|
2015-04-22 07:23:47 +08:00
|
|
|
|
|
|
|
if (rc == -EINPROGRESS)
|
|
|
|
return;
|
|
|
|
|
|
|
|
ecr->res = rc;
|
|
|
|
complete(&ecr->completion);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
2015-05-16 07:26:10 +08:00
|
|
|
* derive_key_aes() - Derive a key using AES-128-ECB
|
2016-02-06 11:21:41 +08:00
|
|
|
* @deriving_key: Encryption key used for derivation.
|
2015-04-22 07:23:47 +08:00
|
|
|
* @source_key: Source key to which to apply derivation.
|
2017-06-19 15:27:58 +08:00
|
|
|
* @derived_raw_key: Derived raw key.
|
2015-04-22 07:23:47 +08:00
|
|
|
*
|
|
|
|
* Return: Zero on success; non-zero otherwise.
|
|
|
|
*/
|
2015-05-16 07:26:10 +08:00
|
|
|
static int derive_key_aes(u8 deriving_key[FS_AES_128_ECB_KEY_SIZE],
|
2017-06-19 15:27:58 +08:00
|
|
|
const struct fscrypt_key *source_key,
|
|
|
|
u8 derived_raw_key[FS_MAX_KEY_SIZE])
|
2015-04-22 07:23:47 +08:00
|
|
|
{
|
|
|
|
int res = 0;
|
2016-03-22 02:03:02 +08:00
|
|
|
struct skcipher_request *req = NULL;
|
2015-05-16 07:26:10 +08:00
|
|
|
DECLARE_FS_COMPLETION_RESULT(ecr);
|
2015-04-22 07:23:47 +08:00
|
|
|
struct scatterlist src_sg, dst_sg;
|
2016-03-22 02:03:02 +08:00
|
|
|
struct crypto_skcipher *tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0);
|
2015-04-22 07:23:47 +08:00
|
|
|
|
|
|
|
if (IS_ERR(tfm)) {
|
|
|
|
res = PTR_ERR(tfm);
|
|
|
|
tfm = NULL;
|
|
|
|
goto out;
|
|
|
|
}
|
2016-03-22 02:03:02 +08:00
|
|
|
crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_WEAK_KEY);
|
|
|
|
req = skcipher_request_alloc(tfm, GFP_NOFS);
|
2015-04-22 07:23:47 +08:00
|
|
|
if (!req) {
|
|
|
|
res = -ENOMEM;
|
|
|
|
goto out;
|
|
|
|
}
|
2016-03-22 02:03:02 +08:00
|
|
|
skcipher_request_set_callback(req,
|
2015-04-22 07:23:47 +08:00
|
|
|
CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
|
|
|
|
derive_crypt_complete, &ecr);
|
2016-03-22 02:03:02 +08:00
|
|
|
res = crypto_skcipher_setkey(tfm, deriving_key,
|
2015-05-16 07:26:10 +08:00
|
|
|
FS_AES_128_ECB_KEY_SIZE);
|
2015-04-22 07:23:47 +08:00
|
|
|
if (res < 0)
|
|
|
|
goto out;
|
|
|
|
|
2017-06-19 15:27:58 +08:00
|
|
|
sg_init_one(&src_sg, source_key->raw, source_key->size);
|
|
|
|
sg_init_one(&dst_sg, derived_raw_key, source_key->size);
|
|
|
|
skcipher_request_set_crypt(req, &src_sg, &dst_sg, source_key->size,
|
|
|
|
NULL);
|
2016-03-22 02:03:02 +08:00
|
|
|
res = crypto_skcipher_encrypt(req);
|
2015-04-22 07:23:47 +08:00
|
|
|
if (res == -EINPROGRESS || res == -EBUSY) {
|
|
|
|
wait_for_completion(&ecr.completion);
|
|
|
|
res = ecr.res;
|
|
|
|
}
|
|
|
|
out:
|
2016-03-22 02:03:02 +08:00
|
|
|
skcipher_request_free(req);
|
|
|
|
crypto_free_skcipher(tfm);
|
2015-04-22 07:23:47 +08:00
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
2016-05-05 13:05:01 +08:00
|
|
|
static int validate_user_key(struct fscrypt_info *crypt_info,
|
|
|
|
struct fscrypt_context *ctx, u8 *raw_key,
|
2017-06-19 15:27:58 +08:00
|
|
|
const char *prefix, int min_keysize)
|
2016-05-05 13:05:01 +08:00
|
|
|
{
|
2017-01-06 05:51:18 +08:00
|
|
|
char *description;
|
2016-05-05 13:05:01 +08:00
|
|
|
struct key *keyring_key;
|
|
|
|
struct fscrypt_key *master_key;
|
|
|
|
const struct user_key_payload *ukp;
|
|
|
|
int res;
|
|
|
|
|
2017-01-06 05:51:18 +08:00
|
|
|
description = kasprintf(GFP_NOFS, "%s%*phN", prefix,
|
|
|
|
FS_KEY_DESCRIPTOR_SIZE,
|
|
|
|
ctx->master_key_descriptor);
|
|
|
|
if (!description)
|
2016-05-05 13:05:01 +08:00
|
|
|
return -ENOMEM;
|
|
|
|
|
2017-01-06 05:51:18 +08:00
|
|
|
keyring_key = request_key(&key_type_logon, description, NULL);
|
|
|
|
kfree(description);
|
2016-05-05 13:05:01 +08:00
|
|
|
if (IS_ERR(keyring_key))
|
|
|
|
return PTR_ERR(keyring_key);
|
fscrypt: remove broken support for detecting keyring key revocation
Filesystem encryption ostensibly supported revoking a keyring key that
had been used to "unlock" encrypted files, causing those files to become
"locked" again. This was, however, buggy for several reasons, the most
severe of which was that when key revocation happened to be detected for
an inode, its fscrypt_info was immediately freed, even while other
threads could be using it for encryption or decryption concurrently.
This could be exploited to crash the kernel or worse.
This patch fixes the use-after-free by removing the code which detects
the keyring key having been revoked, invalidated, or expired. Instead,
an encrypted inode that is "unlocked" now simply remains unlocked until
it is evicted from memory. Note that this is no worse than the case for
block device-level encryption, e.g. dm-crypt, and it still remains
possible for a privileged user to evict unused pages, inodes, and
dentries by running 'sync; echo 3 > /proc/sys/vm/drop_caches', or by
simply unmounting the filesystem. In fact, one of those actions was
already needed anyway for key revocation to work even somewhat sanely.
This change is not expected to break any applications.
In the future I'd like to implement a real API for fscrypt key
revocation that interacts sanely with ongoing filesystem operations ---
waiting for existing operations to complete and blocking new operations,
and invalidating and sanitizing key material and plaintext from the VFS
caches. But this is a hard problem, and for now this bug must be fixed.
This bug affected almost all versions of ext4, f2fs, and ubifs
encryption, and it was potentially reachable in any kernel configured
with encryption support (CONFIG_EXT4_ENCRYPTION=y,
CONFIG_EXT4_FS_ENCRYPTION=y, CONFIG_F2FS_FS_ENCRYPTION=y, or
CONFIG_UBIFS_FS_ENCRYPTION=y). Note that older kernels did not use the
shared fs/crypto/ code, but due to the potential security implications
of this bug, it may still be worthwhile to backport this fix to them.
Fixes: b7236e21d55f ("ext4 crypto: reorganize how we store keys in the inode")
Cc: stable@vger.kernel.org # v4.2+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Acked-by: Michael Halcrow <mhalcrow@google.com>
2017-02-22 07:07:11 +08:00
|
|
|
down_read(&keyring_key->sem);
|
2016-05-05 13:05:01 +08:00
|
|
|
|
|
|
|
if (keyring_key->type != &key_type_logon) {
|
|
|
|
printk_once(KERN_WARNING
|
|
|
|
"%s: key type must be logon\n", __func__);
|
|
|
|
res = -ENOKEY;
|
|
|
|
goto out;
|
|
|
|
}
|
2017-03-01 23:11:23 +08:00
|
|
|
ukp = user_key_payload_locked(keyring_key);
|
2016-05-05 13:05:01 +08:00
|
|
|
if (ukp->datalen != sizeof(struct fscrypt_key)) {
|
|
|
|
res = -EINVAL;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
master_key = (struct fscrypt_key *)ukp->data;
|
|
|
|
BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE != FS_KEY_DERIVATION_NONCE_SIZE);
|
|
|
|
|
2017-06-19 15:27:58 +08:00
|
|
|
if (master_key->size < min_keysize || master_key->size > FS_MAX_KEY_SIZE
|
|
|
|
|| master_key->size % AES_BLOCK_SIZE != 0) {
|
2016-05-05 13:05:01 +08:00
|
|
|
printk_once(KERN_WARNING
|
|
|
|
"%s: key size incorrect: %d\n",
|
|
|
|
__func__, master_key->size);
|
|
|
|
res = -ENOKEY;
|
|
|
|
goto out;
|
|
|
|
}
|
2017-06-19 15:27:58 +08:00
|
|
|
res = derive_key_aes(ctx->nonce, master_key, raw_key);
|
2016-05-05 13:05:01 +08:00
|
|
|
out:
|
fscrypt: remove broken support for detecting keyring key revocation
Filesystem encryption ostensibly supported revoking a keyring key that
had been used to "unlock" encrypted files, causing those files to become
"locked" again. This was, however, buggy for several reasons, the most
severe of which was that when key revocation happened to be detected for
an inode, its fscrypt_info was immediately freed, even while other
threads could be using it for encryption or decryption concurrently.
This could be exploited to crash the kernel or worse.
This patch fixes the use-after-free by removing the code which detects
the keyring key having been revoked, invalidated, or expired. Instead,
an encrypted inode that is "unlocked" now simply remains unlocked until
it is evicted from memory. Note that this is no worse than the case for
block device-level encryption, e.g. dm-crypt, and it still remains
possible for a privileged user to evict unused pages, inodes, and
dentries by running 'sync; echo 3 > /proc/sys/vm/drop_caches', or by
simply unmounting the filesystem. In fact, one of those actions was
already needed anyway for key revocation to work even somewhat sanely.
This change is not expected to break any applications.
In the future I'd like to implement a real API for fscrypt key
revocation that interacts sanely with ongoing filesystem operations ---
waiting for existing operations to complete and blocking new operations,
and invalidating and sanitizing key material and plaintext from the VFS
caches. But this is a hard problem, and for now this bug must be fixed.
This bug affected almost all versions of ext4, f2fs, and ubifs
encryption, and it was potentially reachable in any kernel configured
with encryption support (CONFIG_EXT4_ENCRYPTION=y,
CONFIG_EXT4_FS_ENCRYPTION=y, CONFIG_F2FS_FS_ENCRYPTION=y, or
CONFIG_UBIFS_FS_ENCRYPTION=y). Note that older kernels did not use the
shared fs/crypto/ code, but due to the potential security implications
of this bug, it may still be worthwhile to backport this fix to them.
Fixes: b7236e21d55f ("ext4 crypto: reorganize how we store keys in the inode")
Cc: stable@vger.kernel.org # v4.2+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Acked-by: Michael Halcrow <mhalcrow@google.com>
2017-02-22 07:07:11 +08:00
|
|
|
up_read(&keyring_key->sem);
|
2016-05-05 13:05:01 +08:00
|
|
|
key_put(keyring_key);
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
2017-06-19 15:27:58 +08:00
|
|
|
static const struct {
|
|
|
|
const char *cipher_str;
|
|
|
|
int keysize;
|
|
|
|
} available_modes[] = {
|
|
|
|
[FS_ENCRYPTION_MODE_AES_256_XTS] = { "xts(aes)",
|
|
|
|
FS_AES_256_XTS_KEY_SIZE },
|
|
|
|
[FS_ENCRYPTION_MODE_AES_256_CTS] = { "cts(cbc(aes))",
|
|
|
|
FS_AES_256_CTS_KEY_SIZE },
|
|
|
|
[FS_ENCRYPTION_MODE_AES_128_CBC] = { "cbc(aes)",
|
|
|
|
FS_AES_128_CBC_KEY_SIZE },
|
|
|
|
[FS_ENCRYPTION_MODE_AES_128_CTS] = { "cts(cbc(aes))",
|
|
|
|
FS_AES_128_CTS_KEY_SIZE },
|
|
|
|
};
|
|
|
|
|
2016-09-16 01:32:11 +08:00
|
|
|
static int determine_cipher_type(struct fscrypt_info *ci, struct inode *inode,
|
|
|
|
const char **cipher_str_ret, int *keysize_ret)
|
|
|
|
{
|
2017-06-19 15:27:58 +08:00
|
|
|
u32 mode;
|
|
|
|
|
|
|
|
if (!fscrypt_valid_enc_modes(ci->ci_data_mode, ci->ci_filename_mode)) {
|
|
|
|
pr_warn_ratelimited("fscrypt: inode %lu uses unsupported encryption modes (contents mode %d, filenames mode %d)\n",
|
|
|
|
inode->i_ino,
|
|
|
|
ci->ci_data_mode, ci->ci_filename_mode);
|
|
|
|
return -EINVAL;
|
2016-09-16 01:32:11 +08:00
|
|
|
}
|
|
|
|
|
2017-06-19 15:27:58 +08:00
|
|
|
if (S_ISREG(inode->i_mode)) {
|
|
|
|
mode = ci->ci_data_mode;
|
|
|
|
} else if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) {
|
|
|
|
mode = ci->ci_filename_mode;
|
|
|
|
} else {
|
|
|
|
WARN_ONCE(1, "fscrypt: filesystem tried to load encryption info for inode %lu, which is not encryptable (file type %d)\n",
|
|
|
|
inode->i_ino, (inode->i_mode & S_IFMT));
|
|
|
|
return -EINVAL;
|
2016-09-16 01:32:11 +08:00
|
|
|
}
|
|
|
|
|
2017-06-19 15:27:58 +08:00
|
|
|
*cipher_str_ret = available_modes[mode].cipher_str;
|
|
|
|
*keysize_ret = available_modes[mode].keysize;
|
|
|
|
return 0;
|
2016-09-16 01:32:11 +08:00
|
|
|
}
|
|
|
|
|
2015-05-16 07:26:10 +08:00
|
|
|
static void put_crypt_info(struct fscrypt_info *ci)
|
2015-04-22 07:23:47 +08:00
|
|
|
{
|
|
|
|
if (!ci)
|
|
|
|
return;
|
|
|
|
|
2016-03-22 02:03:02 +08:00
|
|
|
crypto_free_skcipher(ci->ci_ctfm);
|
2017-06-19 15:27:58 +08:00
|
|
|
crypto_free_cipher(ci->ci_essiv_tfm);
|
2015-05-16 07:26:10 +08:00
|
|
|
kmem_cache_free(fscrypt_info_cachep, ci);
|
2015-04-22 07:23:47 +08:00
|
|
|
}
|
|
|
|
|
2017-06-19 15:27:58 +08:00
|
|
|
static int derive_essiv_salt(const u8 *key, int keysize, u8 *salt)
|
|
|
|
{
|
|
|
|
struct crypto_shash *tfm = READ_ONCE(essiv_hash_tfm);
|
|
|
|
|
|
|
|
/* init hash transform on demand */
|
|
|
|
if (unlikely(!tfm)) {
|
|
|
|
struct crypto_shash *prev_tfm;
|
|
|
|
|
|
|
|
tfm = crypto_alloc_shash("sha256", 0, 0);
|
|
|
|
if (IS_ERR(tfm)) {
|
|
|
|
pr_warn_ratelimited("fscrypt: error allocating SHA-256 transform: %ld\n",
|
|
|
|
PTR_ERR(tfm));
|
|
|
|
return PTR_ERR(tfm);
|
|
|
|
}
|
|
|
|
prev_tfm = cmpxchg(&essiv_hash_tfm, NULL, tfm);
|
|
|
|
if (prev_tfm) {
|
|
|
|
crypto_free_shash(tfm);
|
|
|
|
tfm = prev_tfm;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
{
|
|
|
|
SHASH_DESC_ON_STACK(desc, tfm);
|
|
|
|
desc->tfm = tfm;
|
|
|
|
desc->flags = 0;
|
|
|
|
|
|
|
|
return crypto_shash_digest(desc, key, keysize, salt);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static int init_essiv_generator(struct fscrypt_info *ci, const u8 *raw_key,
|
|
|
|
int keysize)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
struct crypto_cipher *essiv_tfm;
|
|
|
|
u8 salt[SHA256_DIGEST_SIZE];
|
|
|
|
|
|
|
|
essiv_tfm = crypto_alloc_cipher("aes", 0, 0);
|
|
|
|
if (IS_ERR(essiv_tfm))
|
|
|
|
return PTR_ERR(essiv_tfm);
|
|
|
|
|
|
|
|
ci->ci_essiv_tfm = essiv_tfm;
|
|
|
|
|
|
|
|
err = derive_essiv_salt(raw_key, keysize, salt);
|
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Using SHA256 to derive the salt/key will result in AES-256 being
|
|
|
|
* used for IV generation. File contents encryption will still use the
|
|
|
|
* configured keysize (AES-128) nevertheless.
|
|
|
|
*/
|
|
|
|
err = crypto_cipher_setkey(essiv_tfm, salt, sizeof(salt));
|
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
out:
|
|
|
|
memzero_explicit(salt, sizeof(salt));
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
void __exit fscrypt_essiv_cleanup(void)
|
|
|
|
{
|
|
|
|
crypto_free_shash(essiv_hash_tfm);
|
|
|
|
}
|
|
|
|
|
fscrypt: remove broken support for detecting keyring key revocation
Filesystem encryption ostensibly supported revoking a keyring key that
had been used to "unlock" encrypted files, causing those files to become
"locked" again. This was, however, buggy for several reasons, the most
severe of which was that when key revocation happened to be detected for
an inode, its fscrypt_info was immediately freed, even while other
threads could be using it for encryption or decryption concurrently.
This could be exploited to crash the kernel or worse.
This patch fixes the use-after-free by removing the code which detects
the keyring key having been revoked, invalidated, or expired. Instead,
an encrypted inode that is "unlocked" now simply remains unlocked until
it is evicted from memory. Note that this is no worse than the case for
block device-level encryption, e.g. dm-crypt, and it still remains
possible for a privileged user to evict unused pages, inodes, and
dentries by running 'sync; echo 3 > /proc/sys/vm/drop_caches', or by
simply unmounting the filesystem. In fact, one of those actions was
already needed anyway for key revocation to work even somewhat sanely.
This change is not expected to break any applications.
In the future I'd like to implement a real API for fscrypt key
revocation that interacts sanely with ongoing filesystem operations ---
waiting for existing operations to complete and blocking new operations,
and invalidating and sanitizing key material and plaintext from the VFS
caches. But this is a hard problem, and for now this bug must be fixed.
This bug affected almost all versions of ext4, f2fs, and ubifs
encryption, and it was potentially reachable in any kernel configured
with encryption support (CONFIG_EXT4_ENCRYPTION=y,
CONFIG_EXT4_FS_ENCRYPTION=y, CONFIG_F2FS_FS_ENCRYPTION=y, or
CONFIG_UBIFS_FS_ENCRYPTION=y). Note that older kernels did not use the
shared fs/crypto/ code, but due to the potential security implications
of this bug, it may still be worthwhile to backport this fix to them.
Fixes: b7236e21d55f ("ext4 crypto: reorganize how we store keys in the inode")
Cc: stable@vger.kernel.org # v4.2+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Acked-by: Michael Halcrow <mhalcrow@google.com>
2017-02-22 07:07:11 +08:00
|
|
|
int fscrypt_get_encryption_info(struct inode *inode)
|
2015-04-22 07:23:47 +08:00
|
|
|
{
|
2015-05-16 07:26:10 +08:00
|
|
|
struct fscrypt_info *crypt_info;
|
|
|
|
struct fscrypt_context ctx;
|
2016-03-22 02:03:02 +08:00
|
|
|
struct crypto_skcipher *ctfm;
|
2015-05-20 13:26:54 +08:00
|
|
|
const char *cipher_str;
|
2016-09-16 01:32:11 +08:00
|
|
|
int keysize;
|
2016-11-14 09:41:09 +08:00
|
|
|
u8 *raw_key = NULL;
|
2015-04-22 07:23:47 +08:00
|
|
|
int res;
|
|
|
|
|
fscrypt: remove broken support for detecting keyring key revocation
Filesystem encryption ostensibly supported revoking a keyring key that
had been used to "unlock" encrypted files, causing those files to become
"locked" again. This was, however, buggy for several reasons, the most
severe of which was that when key revocation happened to be detected for
an inode, its fscrypt_info was immediately freed, even while other
threads could be using it for encryption or decryption concurrently.
This could be exploited to crash the kernel or worse.
This patch fixes the use-after-free by removing the code which detects
the keyring key having been revoked, invalidated, or expired. Instead,
an encrypted inode that is "unlocked" now simply remains unlocked until
it is evicted from memory. Note that this is no worse than the case for
block device-level encryption, e.g. dm-crypt, and it still remains
possible for a privileged user to evict unused pages, inodes, and
dentries by running 'sync; echo 3 > /proc/sys/vm/drop_caches', or by
simply unmounting the filesystem. In fact, one of those actions was
already needed anyway for key revocation to work even somewhat sanely.
This change is not expected to break any applications.
In the future I'd like to implement a real API for fscrypt key
revocation that interacts sanely with ongoing filesystem operations ---
waiting for existing operations to complete and blocking new operations,
and invalidating and sanitizing key material and plaintext from the VFS
caches. But this is a hard problem, and for now this bug must be fixed.
This bug affected almost all versions of ext4, f2fs, and ubifs
encryption, and it was potentially reachable in any kernel configured
with encryption support (CONFIG_EXT4_ENCRYPTION=y,
CONFIG_EXT4_FS_ENCRYPTION=y, CONFIG_F2FS_FS_ENCRYPTION=y, or
CONFIG_UBIFS_FS_ENCRYPTION=y). Note that older kernels did not use the
shared fs/crypto/ code, but due to the potential security implications
of this bug, it may still be worthwhile to backport this fix to them.
Fixes: b7236e21d55f ("ext4 crypto: reorganize how we store keys in the inode")
Cc: stable@vger.kernel.org # v4.2+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Acked-by: Michael Halcrow <mhalcrow@google.com>
2017-02-22 07:07:11 +08:00
|
|
|
if (inode->i_crypt_info)
|
|
|
|
return 0;
|
|
|
|
|
2016-12-07 06:53:57 +08:00
|
|
|
res = fscrypt_initialize(inode->i_sb->s_cop->flags);
|
2015-05-16 06:37:24 +08:00
|
|
|
if (res)
|
|
|
|
return res;
|
2015-05-16 07:26:10 +08:00
|
|
|
|
|
|
|
res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx));
|
|
|
|
if (res < 0) {
|
2017-01-03 04:12:17 +08:00
|
|
|
if (!fscrypt_dummy_context_enabled(inode) ||
|
|
|
|
inode->i_sb->s_cop->is_encrypted(inode))
|
2015-05-16 07:26:10 +08:00
|
|
|
return res;
|
2017-01-03 04:12:17 +08:00
|
|
|
/* Fake up a context for an unencrypted directory */
|
|
|
|
memset(&ctx, 0, sizeof(ctx));
|
2016-09-16 01:32:11 +08:00
|
|
|
ctx.format = FS_ENCRYPTION_CONTEXT_FORMAT_V1;
|
2015-05-16 07:26:10 +08:00
|
|
|
ctx.contents_encryption_mode = FS_ENCRYPTION_MODE_AES_256_XTS;
|
|
|
|
ctx.filenames_encryption_mode = FS_ENCRYPTION_MODE_AES_256_CTS;
|
2017-01-03 04:12:17 +08:00
|
|
|
memset(ctx.master_key_descriptor, 0x42, FS_KEY_DESCRIPTOR_SIZE);
|
2015-05-16 07:26:10 +08:00
|
|
|
} else if (res != sizeof(ctx)) {
|
2015-04-22 07:23:47 +08:00
|
|
|
return -EINVAL;
|
2015-05-16 07:26:10 +08:00
|
|
|
}
|
2016-09-16 01:32:11 +08:00
|
|
|
|
|
|
|
if (ctx.format != FS_ENCRYPTION_CONTEXT_FORMAT_V1)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
if (ctx.flags & ~FS_POLICY_FLAGS_VALID)
|
|
|
|
return -EINVAL;
|
2015-04-22 07:23:47 +08:00
|
|
|
|
2015-05-16 07:26:10 +08:00
|
|
|
crypt_info = kmem_cache_alloc(fscrypt_info_cachep, GFP_NOFS);
|
2015-04-22 07:23:47 +08:00
|
|
|
if (!crypt_info)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
crypt_info->ci_flags = ctx.flags;
|
|
|
|
crypt_info->ci_data_mode = ctx.contents_encryption_mode;
|
|
|
|
crypt_info->ci_filename_mode = ctx.filenames_encryption_mode;
|
|
|
|
crypt_info->ci_ctfm = NULL;
|
2017-06-19 15:27:58 +08:00
|
|
|
crypt_info->ci_essiv_tfm = NULL;
|
2015-04-22 07:23:47 +08:00
|
|
|
memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor,
|
|
|
|
sizeof(crypt_info->ci_master_key));
|
2015-05-13 04:33:00 +08:00
|
|
|
|
2016-09-16 01:32:11 +08:00
|
|
|
res = determine_cipher_type(crypt_info, inode, &cipher_str, &keysize);
|
|
|
|
if (res)
|
2015-05-20 13:26:54 +08:00
|
|
|
goto out;
|
2016-09-16 01:32:11 +08:00
|
|
|
|
2016-11-14 09:41:09 +08:00
|
|
|
/*
|
|
|
|
* This cannot be a stack buffer because it is passed to the scatterlist
|
|
|
|
* crypto API as part of key derivation.
|
|
|
|
*/
|
|
|
|
res = -ENOMEM;
|
|
|
|
raw_key = kmalloc(FS_MAX_KEY_SIZE, GFP_NOFS);
|
|
|
|
if (!raw_key)
|
|
|
|
goto out;
|
|
|
|
|
2017-06-19 15:27:58 +08:00
|
|
|
res = validate_user_key(crypt_info, &ctx, raw_key, FS_KEY_DESC_PREFIX,
|
|
|
|
keysize);
|
2016-05-05 13:05:01 +08:00
|
|
|
if (res && inode->i_sb->s_cop->key_prefix) {
|
2017-01-06 05:51:18 +08:00
|
|
|
int res2 = validate_user_key(crypt_info, &ctx, raw_key,
|
2017-06-19 15:27:58 +08:00
|
|
|
inode->i_sb->s_cop->key_prefix,
|
|
|
|
keysize);
|
2016-05-05 13:05:01 +08:00
|
|
|
if (res2) {
|
|
|
|
if (res2 == -ENOKEY)
|
|
|
|
res = -ENOKEY;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
} else if (res) {
|
2016-02-06 11:19:01 +08:00
|
|
|
goto out;
|
|
|
|
}
|
2016-03-22 02:03:02 +08:00
|
|
|
ctfm = crypto_alloc_skcipher(cipher_str, 0, 0);
|
2015-05-20 13:26:54 +08:00
|
|
|
if (!ctfm || IS_ERR(ctfm)) {
|
|
|
|
res = ctfm ? PTR_ERR(ctfm) : -ENOMEM;
|
2017-06-19 15:27:58 +08:00
|
|
|
pr_debug("%s: error %d (inode %lu) allocating crypto tfm\n",
|
|
|
|
__func__, res, inode->i_ino);
|
2015-05-20 13:26:54 +08:00
|
|
|
goto out;
|
2015-04-22 07:23:47 +08:00
|
|
|
}
|
2015-05-20 13:26:54 +08:00
|
|
|
crypt_info->ci_ctfm = ctfm;
|
2016-03-22 02:03:02 +08:00
|
|
|
crypto_skcipher_clear_flags(ctfm, ~0);
|
|
|
|
crypto_skcipher_set_flags(ctfm, CRYPTO_TFM_REQ_WEAK_KEY);
|
2017-06-19 15:27:58 +08:00
|
|
|
/*
|
|
|
|
* if the provided key is longer than keysize, we use the first
|
|
|
|
* keysize bytes of the derived key only
|
|
|
|
*/
|
2016-09-16 01:32:11 +08:00
|
|
|
res = crypto_skcipher_setkey(ctfm, raw_key, keysize);
|
2015-05-20 13:26:54 +08:00
|
|
|
if (res)
|
|
|
|
goto out;
|
|
|
|
|
2017-06-19 15:27:58 +08:00
|
|
|
if (S_ISREG(inode->i_mode) &&
|
|
|
|
crypt_info->ci_data_mode == FS_ENCRYPTION_MODE_AES_128_CBC) {
|
|
|
|
res = init_essiv_generator(crypt_info, raw_key, keysize);
|
|
|
|
if (res) {
|
|
|
|
pr_debug("%s: error %d (inode %lu) allocating essiv tfm\n",
|
|
|
|
__func__, res, inode->i_ino);
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
}
|
fscrypt: remove broken support for detecting keyring key revocation
Filesystem encryption ostensibly supported revoking a keyring key that
had been used to "unlock" encrypted files, causing those files to become
"locked" again. This was, however, buggy for several reasons, the most
severe of which was that when key revocation happened to be detected for
an inode, its fscrypt_info was immediately freed, even while other
threads could be using it for encryption or decryption concurrently.
This could be exploited to crash the kernel or worse.
This patch fixes the use-after-free by removing the code which detects
the keyring key having been revoked, invalidated, or expired. Instead,
an encrypted inode that is "unlocked" now simply remains unlocked until
it is evicted from memory. Note that this is no worse than the case for
block device-level encryption, e.g. dm-crypt, and it still remains
possible for a privileged user to evict unused pages, inodes, and
dentries by running 'sync; echo 3 > /proc/sys/vm/drop_caches', or by
simply unmounting the filesystem. In fact, one of those actions was
already needed anyway for key revocation to work even somewhat sanely.
This change is not expected to break any applications.
In the future I'd like to implement a real API for fscrypt key
revocation that interacts sanely with ongoing filesystem operations ---
waiting for existing operations to complete and blocking new operations,
and invalidating and sanitizing key material and plaintext from the VFS
caches. But this is a hard problem, and for now this bug must be fixed.
This bug affected almost all versions of ext4, f2fs, and ubifs
encryption, and it was potentially reachable in any kernel configured
with encryption support (CONFIG_EXT4_ENCRYPTION=y,
CONFIG_EXT4_FS_ENCRYPTION=y, CONFIG_F2FS_FS_ENCRYPTION=y, or
CONFIG_UBIFS_FS_ENCRYPTION=y). Note that older kernels did not use the
shared fs/crypto/ code, but due to the potential security implications
of this bug, it may still be worthwhile to backport this fix to them.
Fixes: b7236e21d55f ("ext4 crypto: reorganize how we store keys in the inode")
Cc: stable@vger.kernel.org # v4.2+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Acked-by: Michael Halcrow <mhalcrow@google.com>
2017-02-22 07:07:11 +08:00
|
|
|
if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) == NULL)
|
|
|
|
crypt_info = NULL;
|
2015-05-20 13:26:54 +08:00
|
|
|
out:
|
2015-05-16 07:26:10 +08:00
|
|
|
if (res == -ENOKEY)
|
2015-05-20 13:26:54 +08:00
|
|
|
res = 0;
|
2015-05-16 07:26:10 +08:00
|
|
|
put_crypt_info(crypt_info);
|
2016-11-14 09:41:09 +08:00
|
|
|
kzfree(raw_key);
|
2015-04-22 07:23:47 +08:00
|
|
|
return res;
|
|
|
|
}
|
fscrypt: remove broken support for detecting keyring key revocation
Filesystem encryption ostensibly supported revoking a keyring key that
had been used to "unlock" encrypted files, causing those files to become
"locked" again. This was, however, buggy for several reasons, the most
severe of which was that when key revocation happened to be detected for
an inode, its fscrypt_info was immediately freed, even while other
threads could be using it for encryption or decryption concurrently.
This could be exploited to crash the kernel or worse.
This patch fixes the use-after-free by removing the code which detects
the keyring key having been revoked, invalidated, or expired. Instead,
an encrypted inode that is "unlocked" now simply remains unlocked until
it is evicted from memory. Note that this is no worse than the case for
block device-level encryption, e.g. dm-crypt, and it still remains
possible for a privileged user to evict unused pages, inodes, and
dentries by running 'sync; echo 3 > /proc/sys/vm/drop_caches', or by
simply unmounting the filesystem. In fact, one of those actions was
already needed anyway for key revocation to work even somewhat sanely.
This change is not expected to break any applications.
In the future I'd like to implement a real API for fscrypt key
revocation that interacts sanely with ongoing filesystem operations ---
waiting for existing operations to complete and blocking new operations,
and invalidating and sanitizing key material and plaintext from the VFS
caches. But this is a hard problem, and for now this bug must be fixed.
This bug affected almost all versions of ext4, f2fs, and ubifs
encryption, and it was potentially reachable in any kernel configured
with encryption support (CONFIG_EXT4_ENCRYPTION=y,
CONFIG_EXT4_FS_ENCRYPTION=y, CONFIG_F2FS_FS_ENCRYPTION=y, or
CONFIG_UBIFS_FS_ENCRYPTION=y). Note that older kernels did not use the
shared fs/crypto/ code, but due to the potential security implications
of this bug, it may still be worthwhile to backport this fix to them.
Fixes: b7236e21d55f ("ext4 crypto: reorganize how we store keys in the inode")
Cc: stable@vger.kernel.org # v4.2+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Acked-by: Michael Halcrow <mhalcrow@google.com>
2017-02-22 07:07:11 +08:00
|
|
|
EXPORT_SYMBOL(fscrypt_get_encryption_info);
|
2015-04-22 07:23:47 +08:00
|
|
|
|
2015-05-16 07:26:10 +08:00
|
|
|
void fscrypt_put_encryption_info(struct inode *inode, struct fscrypt_info *ci)
|
2015-04-22 07:23:47 +08:00
|
|
|
{
|
2015-05-16 07:26:10 +08:00
|
|
|
struct fscrypt_info *prev;
|
|
|
|
|
|
|
|
if (ci == NULL)
|
|
|
|
ci = ACCESS_ONCE(inode->i_crypt_info);
|
|
|
|
if (ci == NULL)
|
|
|
|
return;
|
2015-04-22 07:23:47 +08:00
|
|
|
|
2015-05-16 07:26:10 +08:00
|
|
|
prev = cmpxchg(&inode->i_crypt_info, ci, NULL);
|
|
|
|
if (prev != ci)
|
|
|
|
return;
|
|
|
|
|
|
|
|
put_crypt_info(ci);
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(fscrypt_put_encryption_info);
|